Excess of Democracy blog has a post about trackers on lawprof blogs. Coincidentally, I spent a couple of hours today trying to figure out why it is that gtmerix reports that discourse.net has this redirect, which both slows the site and amounts to a tracker on users:
- http://b.scorecardresearch.com/b?c1=8&c2=2101&c3=1234567891234567891&ns__t=1389660579364&ns_c=windows-1252&c8=&c7=http%3A%2F%2Fdg.specificclick.net%2F%3Fy%3D3%26t%3Dh%26u%3Dhttp%253A%252F%252Fwww.discourse.net%252F%26r%3D&c9=http%3A%2F%2Fwww.discourse.net%2F
- http://b.scorecardresearch.com/b2?c1=8&c2=2101&c3=1234567891234567891&ns__t=1389660579364&ns_c=windows-1252&c8=&c7=http%3A%2F%2Fdg.specificclick.net%2F%3Fy%3D3%26t%3Dh%26u%3Dhttp%253A%252F%252Fwww.discourse.net%252F%26r%3D&c9=http%3A%2F%2Fwww.discourse.net%2F
I certainly didn’t put any of that in here on purpose. I have grepped all the code for this site and the words “scorecardresearch” and “specificclick” don’t appear anywhere in it. That means either something is inserting the code, or it is obfuscated in some way.
I can imagine three possibilities: (1) a plugin has some javascript; (2) something in the right margin; (3) a malicious code injection.
I tried disabling several of the plugins (but not all as some are essential), but nothing changed. I tried removing a couple of the most likely suspects from the right margin, but that wasn’t it. I don’t know how to look for the code injection.
Any thoughts on how best to track this down?